What does GCHQ know about our devices that we don’t? – Privacy International

Surprisingly, however, GCHQ were not just interested in hard drives nor did they destroy whole devices. An examination of the targeted hardware by Privacy International, with cooperation from the Guardian, has found the whole episode to be more troubling and puzzling than previously believed. 1

During our investigation, we were surprised to learn that a few very specific components on devices, such as the keyboard, trackpad and monitor, were targeted along with apparently trivial chips on the main boards of laptops and desktops. Initial consultation with members of the technology community supported our identification of the components and that the actions of GCHQ were worth analysing further.

Whatever the actual vendor and role of the chip, we need to know more about why GCHQ believes that these components can store user data and retain that data without power.

What was targeted?

We examined all the destroyed components, and while much was destroyed, our intial investigation will look to find out more about the following components targeted by GCHQ:

keyboard controller chip

trackpad controller chip

inverting converter chip

Below, the left image shows a keyboard controller board intact while the right image is the destroyed component provided by the Guardian. From our analysis, we believe the targeted component of the keyboard is the keyboard encoder responsible for communicating over the USB and interpreting key presses on its various I/O pins. We believe this component, under the black covering in the image below, is similar in function to the chip described here.

Intact Keyboard Component

Destroyed Keyboard Component

We have reached out to the following companies to ascertain the storage characteristics of a USB keyboard: Apple, Dell, HP, Logitech and Microsoft.

In relation to the trackpad, the first image below shows an intact trackpad controller board from a MacBook Air device, while the second image below shows the destroyed component. We believe the targeted component is a serial flash chip that may perform a similar function to the keyboard controller also targeted. It is noteworthy that the device in question uses the controller board on the trackpad to also connect the keyboard to the main device. We believe the component to be similar to the one described here.

Intact Trackpad Component

Destroyed Trackpad Component

We have reached out to Apple and Synaptics to ascertain the storage characteristics of their trackpads and the components they use.

The final component is an inverting converter, again used on the Apple MacBook Air systems. The image below to the left depicts a similar model to the one destroyed with the component intact while the image to the right clearly shows the component targeted. Due to the generality of this component, it is difficult to ascertain what role this plays in the overall operation of the device, however we believe this component is similar in function to the chip described here.

Intact Inverting Converter Component

Destroyed Inverting Converter Component

We have reached out to Apple to understand the storage characteristics of this component and the role it plays in overall device operation

In light of GCHQ’s actions, we have asked hardware manufacturers to explain what these elements actually do: what information can be stored on a device, how much information it can retain, and for how long.